Keycard has launched Keycard for Multi-Agent Apps, an identity and access management platform that gives autonomous AI agents their own verifiable identities and enforces per-task, narrowly scoped permissions across multi-hop agent workflows. The announcement was made at the AI Council 2026 conference in San Francisco this week.
The core mechanism is OAuth 2.0 Token Exchange (RFC 8693). As one agent delegates work to another, Keycard narrows permissions at each handoff so no downstream agent inherits more access than its assigned task requires. Every token in the chain is traceable, revocable, and expires with the session; the platform manages the full token lifecycle including issuance, storage, rotation, attenuation, and revocation. The approach targets the risk posed by static API keys and long-lived credentials, which currently expose enterprise systems to over-privileged automation. A SpyCloud report in March of this year documented 18.1 million exposed non-human credentials in 2025 as attackers shifted focus from human to machine credential theft.
“Developers building these systems have to choose: give agents broad access and they’re ungovernable or lock them down and lose what makes them valuable,” said Ian Livingstone, Co-Founder and CEO of Keycard. “Agents built using Keycard don’t experience this trade-off, as they have their own identity, delegate access per-task and operate with no standing privileges or static credentials.”
The platform supports three delegation patterns: agents operating independently with scoped identity across multi-hop workflows; agents delegating on behalf of humans or other agents while preserving authority chains; and agents operating under policy constraints with full audit transparency. Agent discovery and authentication are handled via Client ID Metadata Documents. The platform integrates with LangChain, Mastra, and MCP-compatible agents including Claude and Codex, with SDKs available for Python, TypeScript, and Go. Deployment options include Vercel, Cloudflare, Fly.io, AWS, GCP, and Azure. Keycard for Multi-Agent Apps is available in early access.
Keycard is building in a space that has attracted significant M&A activity, including CrowdStrike’s acquisition of SGNL for AI agent identity in January 2026. NIST opened a public comment period on AI agent identity and authorization standards in March 2026, the same OAuth-aligned standards environment Keycard’s token-exchange approach is designed to address.
Dennis Yang, Principal Product Manager for Generative AI at Chime, said the company “had agents running against production systems in days” of implementing the platform. Andreessen Horowitz Partner Zane Lackey described the product as “the foundational authorization infrastructure moment for the agent sector.”
Keycard emerged from stealth in October of 2025 with $38 million in combined seed and Series A funding. The $8 million seed was co-led by Andreessen Horowitz and Boldstart Ventures; the $30 million Series A was led by Acrew Capital. The founding team includes Livingstone, Matthew Creager, and Jared Hanson. In February 2026, Keycard acquired Anchor.dev to add infrastructure certificate management.
Sources: Yahoo Finance, SecurityWeek, SiliconAngle
–
By Cass Kennedy
